search

axiomatic-systems / Bento4

Full-featured MP4 format, MPEG DASH, HLS, CMAF SDK and tools
http://www.bento4.com
2.03k stars 483 forks source link

AddressSanitizer: heap-buffer-overflow in mp42aac #952

Closed gpriamo closed 6 months ago

gpriamo commented 7 months ago

Describe the bug

AddressSanitizer: heap-buffer-overflow in mp42aac.

To Reproduce

Built Bento4 release v1.6.0-641 according to the instructions in the README.md file.

ASAN Output

./mp42aaac <testcase> /dev/null

=================================================================
==3793750==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000000098 at pc 0x0000005e1bb1 bp 0x7ffefdbd4cf0 sp 0x7ffefdbd4ce8
READ of size 1 at 0x602000000098 thread T0
    #0 0x5e1bb0 in AP4_BytesToUInt16BE(unsigned char const*) BUILD/Source/C++/Core/Ap4Utils.h:113:22
    #1 0x5e1bb0 in AP4_Stz2Atom::AP4_Stz2Atom(unsigned int, unsigned char, unsigned int, AP4_ByteStream&) BUILD/Source/C++/Core/Ap4Stz2Atom.cpp:128:32
    #2 0x5e0fbf in AP4_Stz2Atom::Create(unsigned int, AP4_ByteStream&) BUILD/Source/C++/Core/Ap4Stz2Atom.cpp:52:16
    #3 0x53c928 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned int, unsigned int, unsigned long long, AP4_Atom*&) BUILD/Source/C++/Core/Ap4AtomFactory.cpp:483:20
    #4 0x53b504 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned long long&, AP4_Atom*&) BUILD/Source/C++/Core/Ap4AtomFactory.cpp:234:14
    #5 0x53ad2e in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, AP4_Atom*&) BUILD/Source/C++/Core/Ap4AtomFactory.cpp:154:12
    #6 0x4d7a5e in AP4_File::ParseStream(AP4_ByteStream&, AP4_AtomFactory&, bool) BUILD/Source/C++/Core/Ap4File.cpp:104:12
    #7 0x4d7f3d in AP4_File::AP4_File(AP4_ByteStream&, bool) BUILD/Source/C++/Core/Ap4File.cpp:78:5
    #8 0x4cf726 in main BUILD/Source/C++/Apps/Mp42Aac/Mp42Aac.cpp:250:22
    #9 0x7f6838944082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082)
    #10 0x41d6dd in _start (mp42aac+0x41d6dd)

0x602000000098 is located 0 bytes to the right of 8-byte region [0x602000000090,0x602000000098)
allocated by thread T0 here:
    #0 0x4c959d in operator new[](unsigned long) /tmp/llvm/utils/release/final/llvm-project/compiler-rt/lib/asan/asan_new_delete.cpp:102:3
    #1 0x5e141b in AP4_Stz2Atom::AP4_Stz2Atom(unsigned int, unsigned char, unsigned int, AP4_ByteStream&) BUILD/Source/C++/Core/Ap4Stz2Atom.cpp:101:29
    #2 0x5e0fbf in AP4_Stz2Atom::Create(unsigned int, AP4_ByteStream&) BUILD/Source/C++/Core/Ap4Stz2Atom.cpp:52:16
    #3 0x53c928 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned int, unsigned int, unsigned long long, AP4_Atom*&) BUILD/Source/C++/Core/Ap4AtomFactory.cpp:483:20
    #4 0x53b504 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned long long&, AP4_Atom*&) BUILD/Source/C++/Core/Ap4AtomFactory.cpp:234:14
    #5 0x53ad2e in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, AP4_Atom*&) BUILD/Source/C++/Core/Ap4AtomFactory.cpp:154:12
    #6 0x4d7a5e in AP4_File::ParseStream(AP4_ByteStream&, AP4_AtomFactory&, bool) BUILD/Source/C++/Core/Ap4File.cpp:104:12
    #7 0x4d7f3d in AP4_File::AP4_File(AP4_ByteStream&, bool) BUILD/Source/C++/Core/Ap4File.cpp:78:5
    #8 0x4cf726 in main BUILD/Source/C++/Apps/Mp42Aac/Mp42Aac.cpp:250:22
    #9 0x7f6838944082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082)

SUMMARY: AddressSanitizer: heap-buffer-overflow BUILD/Source/C++/Core/Ap4Utils.h:113:22 in AP4_BytesToUInt16BE(unsigned char const*)
Shadow bytes around the buggy address:
  0x0c047fff7fc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c047fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c047fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c047fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c047fff8000: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa 00 00
=>0x0c047fff8010: fa fa 00[fa]fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff8020: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff8030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb

  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==3793750==ABORTING

Environment info

OS: Ubuntu 20.04.6
Bento v1.6.0-641

Crashing file

Please find the file provoking the crash inside the testcase.zip archive

testcase.zip